People and machines are collecting data at an unprecedented rate. Despite this newfound abundance of data, progress has been slow in sharing it for open science, business, and other data-intensive endeavors. Many such efforts are stymied by privacy concerns and regulatory compliance issues. For example, many hospitals are interested in pooling their medical records for research, but none may disclose arbitrary patient records to researchers or other healthcare providers. In this context we propose the Private Data Network (PDN), a federated database for querying over the collective data of mutually distrustful parties. In a PDN, each member database does not reveal its tuples to its peers nor to the query writer. Instead, the user submits a query to an honest broker that plans and coordinates its execution over multiple private databases using secure multiparty computation (SMC). Here, each database's query execution is oblivious , and its program counters and memory traces are agnostic to the inputs of others. We introduce a framework for executing PDN queries named smcql . This system translates SQL statements into SMC primitives to compute query results over the union of its source databases without revealing sensitive information about individual tuples to peer data providers or the honest broker. Only the honest broker and the querier receive the results of a PDN query. For fast, secure query evaluation, we explore a heuristics-driven optimizer that minimizes the PDN's use of secure computation and partitions its query evaluation into scalable slices.

OBJECTIVE: To design and implement a tool that creates a secure, privacy preserving linkage of electronic health record (EHR) data across multiple sites in a large metropolitan area in the United States (Chicago, IL), for use in clinical research. METHODS: The authors developed and distributed a software application that performs standardized data cleaning, preprocessing, and hashing of patient identifiers to remove all protected health information. The application creates seeded hash code combinations of patient identifiers using a Health Insurance Portability and Accountability Act compliant SHA-512 algorithm that minimizes re-identification risk. The authors subsequently linked individual records using a central honest broker with an algorithm that assigns weights to hash combinations in order to generate high specificity matches. RESULTS: The software application successfully linked and de-duplicated 7 million records across 6 institutions, resulting in a cohort of 5 million unique records. Using a manually reconciled set of 11 292 patients as a gold standard, the software achieved a sensitivity of 96% and a specificity of 100%, with a majority of the missed matches accounted for by patients with both a missing social security number and last name change. Using 3 disease examples, it is demonstrated that the software can reduce duplication of patient records across sites by as much as 28%. CONCLUSIONS: Software that standardizes the assignment of a unique seeded hash identifier merged through an agreed upon third-party honest broker can enable large-scale secure linkage of EHR data for epidemiologic and public health research. The software algorithm can improve future epidemiologic research by providing more comprehensive data given that patients may make use of multiple healthcare systems.

The Chicago Area Patient-Centered Outcomes Research Network (CAPriCORN) represents an unprecedented collaboration across diverse healthcare institutions including private, county, and state hospitals and health systems, a consortium of Federally Qualified Health Centers, and two Department of Veterans Affairs hospitals. CAPriCORN builds on the strengths of our institutions to develop a cross-cutting infrastructure for sustainable and patient-centered comparative effectiveness research in Chicago. Unique aspects include collaboration with the University HealthSystem Consortium to aggregate data across sites, a centralized communication center to integrate patient recruitment with the data infrastructure, and a centralized institutional review board to ensure a strong and efficient human subject protection program. With coordination by the Chicago Community Trust and the Illinois Medical District Commission, CAPriCORN will model how healthcare institutions can overcome barriers of data integration, marketplace competition, and care fragmentation to develop, test, and implement strategies to improve care for diverse populations and reduce health disparities.